Transfer learning-based cross-regional data leakage tracking method and system

Abstract

The invention discloses a cross-regional data leakage tracking method and system based on transfer learning. The invention discloses a method. By unifying event log formats and time zones, a joint initial graph of accounts, contents, network addresses and service domain names is constructed, invariant risk minimization is applied to an edge-level predictor in territory and platform environments, and few-sample fine tuning is performed in a target area by a lightweight adapter. According to the method, two-stage causal estimation is carried out by taking an anchor point as a tool variable, a twin network of reality and intervention evaluation is combined to calculate a stability index and filter a pseudo edge, and path decoding is carried out under a time non-rebounding constraint, so that cross-domain robust tracking is realized, false alarms are reduced, and path-level interpretability and a visualization effect are improved.

Description

Technical Field

[0001] This invention belongs to the field of data leakage detection and tracing, and specifically relates to a cross-regional data leakage tracking method and system based on transfer learning. Background Technology

[0002] With the widespread adoption of cloud services, social media, and cross-border businesses, data breaches often spread across multiple platforms and regions. Event logs generated by different platforms exhibit significant differences in format, encoding, field standards, and timestamps, and timezone information is inconsistent or missing, posing challenges to the cross-domain reconstruction and visualization of the breach propagation path. Existing technologies have explored various aspects, including log standardization and field mapping, similarity association based on content fingerprints, relationship mining between accounts and network addresses, graph-based propagation path modeling and representation learning using graph neural networks, as well as transfer learning and domain adaptation methods (such as adversarial domain adaptation and invariant risk minimization) to address cross-domain distribution differences. Traditional technologies attempt to filter paths using rules or scoring strategies, but overall, they still primarily rely on relevance inference.

[0003] However, existing technologies still have the following shortcomings: 1. Heterogeneous logs from different platforms and regions are difficult to align under a unified time base. Conventional techniques do not adequately handle time zones and time anomalies, leading to disordered time sequence and the generation of bounces or pseudo-time-series edges, which affects the accuracy of path reconstruction. 2. In scenarios with significant distribution shifts, existing transfer learning methods mostly constrain invariance at the sample or node level, lacking a stabilization mechanism for edge existence determination. This makes it easy to treat spurious correlations specific to the environment as evidence of propagation, and the edge-level determination is unstable across domains, resulting in insufficient path generalization ability. 3. Path selection and visualization rely heavily on static thresholds or single scores, lacking causal and counterfactual assessment methods. They fail to characterize propagation tendencies through instrumental variables and two-stage estimation, and lack interventional testing and stability measurement of candidate edges, making it difficult to effectively eliminate false edges and improve path-level credibility. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a cross-regional data leakage tracking method and system based on transfer learning, which solves the technical problem of difficulty in reconstructing and visualizing leakage propagation paths across platforms and regions.

[0005] To solve the above-mentioned technical problems, the present invention adopts the following technical solution.

[0006] This invention first discloses a cross-regional data leakage tracking method based on transfer learning, which includes the following steps: S1. Unify the format encoding and time zone normalization of the original event logs of the source and target regions, and form a joint normalized event sequence according to the unified timestamp and event field. S2. Based on the joint normalized event sequence, with account, content, network address, and service domain name as nodes, establish edges according to the time sequence, content fingerprint similarity, and network fingerprint correlation to construct a joint initial graph; S3. Train a causal transferable graph encoder on the joint initial graph. Based on three types of evidence channels, namely temporal sequence, content fingerprint and network fingerprint, in a training environment divided by region and platform, apply an invariant risk minimization constraint to the edge predictor to obtain the pre-trained backbone parameters and edge predictor. S4. Extract the target region sub-graph according to the region identifier, attach a lightweight adapter to the input layer, message passing layer and readout layer of the encoder, and fine-tune the pre-trained backbone parameters and side-level predictors using a small number of labeled samples to obtain the target region causal encoder and the target region sub-graph. S5. Extract the anchor point set in the target region subgraph and use it as an instrumental variable to perform two-stage causal estimation to obtain the propagation tendency variable. In the edge-level predictor, combine the propagation tendency variable with the output of the three types of evidence channels to calculate the edge strength score, and combine the time sequence constraint to generate a candidate edge set. S6. Based on the causal encoder of the target region, construct the reality prediction network and the intervention prediction network for the candidate edge set in parallel and evaluate them. Calculate the difference ratio of the credibility of the two paths as the stability index. Delete the false edges based on the threshold to obtain the set of credible edges and the set of stability index. S7. Based on the time non-backflow constraint, edge strength score and stability index, perform path decoding on the set of trusted edges in the target region subgraph to generate a set of leakage propagation paths.

[0007] The present invention further includes the following preferred embodiments: Step S1 further includes: Standardize the format and unify the encoding of the original event logs in the source region and the target region, extract the basic event fields and establish a standard field mapping, so that each event record contains at least a unified timestamp, event type, account identifier, network address, service domain name, content field, region identifier and platform identifier; Based on the available time zone information, the timestamps are converted to a unified time base and sorted according to the unified timestamps to form a time-ordered record sequence. At the same time, duplicate records are deduplicated, missing fields are handled for missing values, and outliers are reasonably corrected, thereby generating a joint normalized event sequence.

[0008] Step S2 further includes: Based on the account identifier, content field, network address and service domain name in the joint normalized event sequence, similar records are aggregated to generate node sets of account entity, content entity, network address entity and service domain name entity respectively; Based on the unified timestamp of the joint normalized event sequence, a directed edge is established between different events involving the same content entity to establish a chronological relationship from front to back. Generate content fingerprints based on content fields, and establish edges for content fingerprint similarity between content entities based on similarity determination; Based on the co-occurrence or access association of network addresses and service domains in the joint normalized event sequence, establish edges for network fingerprint association relationships between account entities, network address entities, service domain entity entities, and content entities; The above set of nodes, along with the edges related to temporal sequence, content fingerprint similarity, and network fingerprint association, are combined to form a joint initial graph.

[0009] Step S3 further includes: The joint initial graph is divided into multiple training environments based on the regional and platform identifiers recorded in the joint initial graph; In each training environment, the causal transferable graph encoder performs message passing and representation learning on the nodes and edges of the joint initial graph, generating node representations and edge feature representations of temporal evidence channels, content fingerprint evidence channels, and network fingerprint evidence channels. The edge-level predictor generates edge existence probability and edge strength scores based on the edge feature representations of the three types of evidence channels, and fuses the outputs of the three types of evidence channels to make a comprehensive judgment on the existence of the edge. The empirical risk is jointly minimized across all training environments, and a boundary-invariant risk minimization constraint is imposed to ensure that the comprehensive decision remains stable across different training environments and is consistent through shared parameters. The pre-trained backbone parameters and side-level predictors are obtained through iterative optimization.

[0010] Step S4 further includes: Extract the target region sub-map from the joint initial map based on the region identifier; Lightweight adapters are attached to the input layer, message passing layer, and readout layer of the causal transferable graph encoder to form a finely adjustable structure; Supervised optimization of pre-trained backbone parameters, edge predictor parameters, and lightweight adapter parameters is performed using labeled samples in the target region subgraph, minimizing the empirical risk of edge predictor in edge existence determination and edge strength scoring in the target region subgraph. After optimization, a causal encoder for the target region is generated, and the causal encoder and the target region subgraph are output.

[0011] Step S5 further includes: In the target region sub-map, an anchor point set is extracted based on content fingerprint, content distribution network domain name, account identifier, and network address features; The anchor set is used as an instrumental variable to perform two-stage causal estimation. In the first stage, the propagation tendency variable is estimated based on the association between the anchor and the event. In the second stage, the propagation tendency variable and the evidence channel output are jointly calculated in the edge-level predictor to obtain the edge strength score, and a candidate edge set is generated based on the edge strength score and the time sequence constraint. Output the set of candidate edges and the edge strength score.

[0012] Step S6 further includes: For the candidate edge set, a two-way parallel evaluation is constructed on the target region subgraph: a reality prediction network and an intervention prediction network. Both evaluations are based on the parameters of the target region causal encoder. The reality prediction network predicts feasible paths containing candidate edges and obtains path credibility without intervention. The path credibility is a path-level score obtained by aggregating edge strength scores and time sequence constraints. The intervention prediction network intervenes on candidate edges or their evidence channels along the same path and obtains the confidence of the path after intervention. The intervention includes at least edge deletion, evidence channel masking, or evidence channel weight reset to zero. The evidence channels include time sequence evidence channels, content fingerprint evidence channels, and network fingerprint evidence channels. The stability index is calculated based on the normalized difference ratio between the path credibility of the actual prediction and the intervention prediction. Candidate edges with a stability index below the threshold are then removed, generating a set of credible edges and a set of stability indices.

[0013] Step S7 further includes: On the target region subgraph, the reachable subgraph is constrained based on the set of credible edges, and a time non-backflow constraint is applied to the candidate paths in the reachable subgraph, so that the unified timestamps corresponding to each node in the path are monotonically non-decreasing and do not form cycles. The path-level score is obtained by weighting and aggregating the edge strength scores and corresponding stability indices of each edge on the candidate path. Based on the path-level score, a threshold is set or sorting is performed to truncate the path. Candidate paths that do not meet the threshold or sorting truncation conditions are deleted, and a set of leakage propagation paths consisting of node sequences and trusted edges between them is generated.

[0014] This invention also discloses a transfer learning-based cross-regional data leakage tracing system utilizing the aforementioned transfer learning-based cross-regional data leakage tracing method, comprising: The joint normalization module is used to unify the format encoding and time zone normalization of the raw event logs of the source and target regions, and form a joint normalized event sequence according to the unified timestamp and event field. The graph construction module is used to construct a joint initial graph based on the joint normalized event sequence, with accounts, content, network addresses, and service domain names as nodes, and to establish edges according to the chronological order, content fingerprint similarity, and network fingerprint correlation. The constraint minimization module is used to train a causal transferable graph encoder on a joint initial graph. Based on three types of evidence channels—temporal sequence, content fingerprint, and network fingerprint—it applies invariant risk minimization constraints to the edge predictors in a training environment divided by region and platform, thereby obtaining pre-trained backbone parameters and edge predictors. The lightweight adapter module is used to extract the target region sub-graph according to the region identifier. The lightweight adapter is attached to the input layer, message passing layer and readout layer of the encoder. The pre-trained backbone parameters and side-level predictors are fine-tuned using a small number of labeled samples to obtain the target region causal encoder and the target region sub-graph. The scoring calculation module is used to extract the anchor point set in the target region subgraph, use it as an instrumental variable to perform two-stage causal estimation, obtain the propagation tendency variable, combine the propagation tendency variable with the three types of evidence channels in the edge-level predictor to calculate the edge strength score, and generate a candidate edge set by combining the time sequence constraint. The parallel evaluation module is used to evaluate the candidate edge set in parallel based on the causal encoder of the target region to construct the real prediction network and the intervention prediction network. It calculates the difference ratio of the credibility of the two paths as the stability index, and deletes false edges based on the threshold to obtain the set of credible edges and the set of stability index. The output module is used to decode the set of trusted edges on the target region subgraph based on the time non-backflow constraint, edge strength score and stability index, and generate a set of leakage propagation paths.

[0015] Accordingly, this application also discloses a terminal, including a processor and a storage medium; The storage medium is used to store instructions; The processor is configured to operate according to the instructions to perform the steps of the aforementioned cross-regional data breach tracing method based on transfer learning.

[0016] Accordingly, this application also discloses a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned cross-regional data leakage tracing method based on transfer learning.

[0017] The beneficial effects of this invention are as follows: Compared with the prior art, this invention provides a cross-regional data leakage tracking method and system based on transfer learning. By imposing invariant risk minimization constraints on the edge-level predictor in multiple environments divided by region and platform, and by using a lightweight adapter for few-sample fine-tuning of the causal transferable graph encoder, the edge existence determination and edge strength score remain consistent under distribution shift conditions, achieving robust path reconstruction across platforms and regions, and reducing transfer errors and annotation costs. Using the anchor point set as an instrumental variable, a two-stage causal estimation is implemented. Edge strength is calculated by jointly using temporal evidence channels, content fingerprint evidence channels, and network fingerprint evidence channels. A stability index is obtained through twin counterfactual evaluation of the real network and the intervention network. False edges and fragile edges are filtered by threshold, significantly improving path-level accuracy and credibility, and enhancing causal interpretability. By unifying the format and time zone of the event log to generate a joint normalized event sequence, a time non-backflow constraint is applied in the path decoding stage, and the edge strength and stability index are weighted, aggregated, and filtered to output a monotonic temporal leakage propagation path set, improving the effectiveness of visualization and audit review. Attached Figure Description

[0018] Figure 1 This is a flowchart of the cross-regional data leakage tracking method based on transfer learning in this invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0020] The embodiments described in this application are merely some, not all, embodiments of the present invention. Based on the spirit of the present invention, other embodiments obtained by those skilled in the art without inventive effort are all within the protection scope of the present invention.

[0021] To address the challenges in existing technologies, such as the difficulty in reconstructing and visualizing propagation paths due to heterogeneous logs across platforms and regions, the instability of edge determination across domains, and the difficulty in eliminating false edges, this invention employs a cross-regional data leakage tracking method and system based on transfer learning. It proposes a technical solution that includes: jointly normalizing event sequences with a unified format and time zone; constructing a joint initial graph of accounts, content, network addresses, and service domains; applying invariant risk minimization to the edge-level predictor using a causal transferable graph encoder in both regional and platform environments, fine-tuning with a lightweight adapter using a small number of samples; implementing two-stage causal estimation using the anchor set as an instrumental variable to obtain propagation tendencies; and using a twin network of real-world and interference prediction evaluations to calculate a stability index to filter false edges and perform path decoding under time-non-backflow constraints. This achieves cross-domain generalization stability, improves the accuracy of edge and path determination, reduces false alarms, and enhances path-level interpretability and visualization.

[0022] See Figure 1 As shown, the cross-regional data leakage tracking method based on transfer learning disclosed in this invention includes the following steps: Step S1: Unify the format encoding and time zone normalization of the original event logs of the source region and the target region, and form a joint normalized event sequence according to the unified timestamp and event field; Step S2: Based on the joint normalized event sequence, with account, content, network address, and service domain name as nodes, establish edges according to the time sequence, content fingerprint similarity, and network fingerprint correlation to construct a joint initial graph; Step S3: Train a causal transferable graph encoder on the joint initial graph. Based on three types of evidence channels—time sequence, content fingerprint, and network fingerprint—apply an invariant risk minimization constraint to the edge predictor in a training environment divided by region and platform to obtain the pre-trained backbone parameters and the edge predictor. Step S4: Extract the target region sub-graph according to the region identifier, attach a lightweight adapter to the input layer, message passing layer and readout layer of the encoder, and fine-tune the pre-trained backbone parameters and side-level predictors using a small number of labeled samples to obtain the target region causal encoder and the target region sub-graph. Step S5: Extract the anchor point set in the target region subgraph and use it as an instrumental variable to perform two-stage causal estimation to obtain the propagation tendency variable. In the edge-level predictor, combine the propagation tendency variable with the output of the three types of evidence channels to calculate the edge strength score, and generate a candidate edge set by combining the time sequence constraint. Step S6: Based on the causal encoder of the target region, construct the reality prediction network and the intervention prediction network for the candidate edge set in parallel and evaluate them. Calculate the difference ratio of the credibility of the two paths as the stability index. Delete pseudo edges based on the threshold to obtain the set of credible edges and the set of stability index. Step S7: On the target region subgraph, based on the time non-backflow constraint, edge strength score and stability index, perform path decoding on the set of trustworthy edges to generate a set of leakage propagation paths.

[0023] Optionally, step S1 further includes: Standardize the format and unify the encoding of the original event logs in the source region and the target region, extract the basic event fields and establish a standard field mapping, so that each event record contains at least a unified timestamp, event type, account identifier, network address, service domain name, content field, region identifier and platform identifier; Based on the available time zone information, the timestamps are converted to a unified time base and sorted according to the unified timestamps to form a time-ordered record sequence. At the same time, duplicate records are deduplicated, missing fields are handled for missing values, and outliers are reasonably corrected, thereby generating a joint normalized event sequence.

[0024] The source region refers to one or more geographical regions indicated by a geographic identifier field, used to provide event logs and participate in data normalization processing; the target region refers to one or more geographical regions indicated by a geographic identifier field, used for migration adaptation and leak tracking, and may be different from or partially overlap with the source region; the original event log is a collection of event-level log records from different platforms / systems before format standardization, encoding unification, and time zone conversion; the format encoding unification refers to the process of converting logs from different sources into a preset unified standard in terms of field names, field types, data structures, and character encoding; the field standard mapping refers to mapping the original field names of each source log. The process of mapping values ​​and data types to a preset standard field set and its value / type specifications, and its application; the time zone normalization is the process of converting the timestamps of each event record to a unified time base based on available time zone information; the unified time base is a unified time standard used to align timestamps from different sources, preferably Coordinated Universal Time (UTC) or its fixed offset; the unified timestamp is the event occurrence time marker represented under the unified time base after time zone normalization; the joint normalized event sequence is a time-ordered record sequence obtained by sorting the original event logs of the source region and the target region according to the unified timestamp after format encoding unification, field standard mapping and time zone normalization.

[0025] In a specific embodiment, step S1 further includes: First, the original event logs from the source and target regions are used as input for format standardization and character encoding unification. Through preset field standard mapping, logs from various sources are grouped into standard records containing a unified timestamp, event type, account identifier, network address, service domain name, content field, region identifier, and platform identifier. Then, time zone normalization and serialization are performed on a unified time base. This process employs a two-step approach centered on field mapping and time conversion. Standardization and mapping can be represented as follows: ; in Indicates the first One original event record, This function maps native field names, values, and data types to a predefined set of standard fields, thus unifying the encoding. for Configuration and parameter set, For the Process the obtained standardized event records, for The original timestamp carried in For the time zone information associated with this record, To change the time zone Mapped to a unified time base The offset function (the unit can be seconds or minutes). This is the converted unified timestamp. The preferred time is Coordinated Universal Time (UTC). After time conversion, serialization is performed using a unified timestamp as the primary key, and the records are cleaned, including deduplication of duplicate records, handling of missing fields, and reasonable correction of outliers, ultimately generating a joint normalized event sequence. ; in For joint normalized event sequences, To use a unified timestamp Sorting operators, The cleaned record set ( (The number recorded after cleaning) To Records after deduplication, missing value processing, and anomaly correction. This is a standardized processing function that includes the three types of cleaning steps mentioned above; In terms of engineering implementation, deduplication can be achieved by using a combination of event unique identifier and content fingerprint as the key. Missing values ​​are handled by deleting, filling with default values, or statistical imputation according to field type, and processing labels are recorded. Outliers are corrected by combining context rules and platform habits, while retaining traceable audit information of the original fields. Time zone normalization prioritizes using explicit time zone fields or server offset identifiers. When these are missing, it uses the region identifier and platform default configuration to infer the time zone and records the inference confidence level. Sorting can be performed using a stable sort within the processing window to preserve the relative input order at the same timestamp, and parallel sequence numbers can be introduced for concurrent events when necessary to avoid time jumps; Unified fields and encoding ensure consistency and reusability of cross-platform, multi-source data in subsequent graph construction and causal assessment through versioned mapping tables and verification processes.

[0026] Optionally, step S2 further includes: Based on the account identifier, content field, network address and service domain name in the joint normalized event sequence, similar records are aggregated to generate node sets of account entity, content entity, network address entity and service domain name entity respectively; Based on the unified timestamp of the joint normalized event sequence, a directed edge is established between different events involving the same content entity to establish a chronological relationship from front to back. Generate content fingerprints based on content fields, and establish edges for content fingerprint similarity between content entities based on similarity determination; Based on the co-occurrence or access association of network addresses and service domains in the joint normalized event sequence, establish edges for network fingerprint association relationships between account entities, network address entities, service domain entity entities, and content entities; The above set of nodes, along with the edges related to temporal sequence, content fingerprint similarity, and network fingerprint association, are combined to form a joint initial graph.

[0027] The account identifier is unique information used to identify the account holder, including but not limited to user ID, account name, email, mobile phone number, or their hashed / normalized representation; the content field is the payload data in the event record used to represent the leaked content, including but not limited to text, filename / path, attachment summary, URL, or their normalized representation; the network address is the network location information in the event record, including but not limited to IPv4 / IPv6 address, port, host and path fragments in the URL, or their normalized representation; the service domain name is the domain name identifier in the event record, including but not limited to FQDN, subdomain, or their normalized representation; and the aggregation of similar records... This process groups event records according to the same type of identifier key (account identifier, content field, network address, or service domain name) to form corresponding entity nodes. The account entity is a graph node representing the same account subject, obtained by aggregating similar records based on the account identifier. The content entity is a graph node representing the same content item, obtained by aggregating similar records based on the content field or its fingerprint. The network address entity is a graph node obtained by aggregating similar records based on the network address. The service domain name entity is a graph node obtained by aggregating similar records based on the service domain name. The node set is a graph node set composed of account entities, content entities, network address entities, and service domain name entities. The directed edges representing the chronological order are directed connections established from front to back according to a unified timestamp between different events involving the same content entity, used to indicate the chronological order of events; the content fingerprint is a fingerprint representation extracted from the content field to uniquely or approximately identify the content, including but not limited to cryptographic hashes, perceptual hashes, fuzzy hashes, or embedded vectors; the similarity determination is a process of comparing two content fingerprints under a selected similarity metric and determining whether to establish a similarity edge; the edge representing the content fingerprint similarity is a connection established between content entities based on the similarity determination of the content fingerprint, used to indicate that the two content entities are semantically or byte-level similar; the common... The occurrence or access association is evidence that a network address and a service domain name co-occur in the same event record, or that an access / resolution / forwarding relationship exists within a set time window; the network fingerprint is a network layer feature representation composed of network addresses, service domain names, and their related protocols, ports, resolution, and connection features; the edges of the network fingerprint association are connections established between account entities, network address entities, service domain name entities, and content entities based on co-occurrence or access association, used to represent network-level association evidence; the joint initial graph is a heterogeneous, multi-relationship, directed graph composed of the above-mentioned node set, time sequence relationship edges, content fingerprint similarity edges, and network fingerprint association relationship edges.

[0028] In a specific embodiment, step S2 further includes: Based on the joint normalized event sequence, nodes and edges are constructed. First, records of the same type are aggregated using four types of keys: account, content, network address, and service domain name, forming corresponding entity nodes. The overall set of nodes is denoted as . This serves as the node space for subsequent graph construction; for evidence of content similarity, content fingerprints are extracted and similarity is established through similarity filtering, where the fingerprint mapping adopts the following method: ; in This field represents the content of a single record. Indicates content The obtained fingerprint vector, Represents a fingerprint or embedding function. This indicates the configuration and parameter set of the function; The fingerprint similarity between two content items is denoted as: ; in Represents two content entities, Indicates the selected similarity measure. For similarity scalars, when Establish content fingerprint similarity edges in time. Indicates the similarity threshold; For evidence of chronological order, directed edges are established from earliest to latest between different events of the same content entity, and the time difference is denoted as: ; in They represent the first With the A unified timestamp for each event Let the time difference between two events be such that when the following conditions are met... and The order of time is preserved. Indicates the time window threshold; For network fingerprint-related evidence, the number of times the same event or within a defined window co-occurs between node pairs is counted and recorded as: ; in This indicates a candidate node (which can be taken from an account, content, network address, or service domain name node). This represents the joint normalized event sequence obtained from step S1. Indicates the time window for network association, when Network-related edges are preserved at the same time. Indicates the co-occurrence count threshold; Finally, the three types of edges are merged into a single edge set, and the initial joint graph is denoted as: ; in Represents the joint initial graph. Denotes the set of edges. The set representing the order of time. Represents the set of edges with similar content fingerprints. Represents the set of edges associated with a network fingerprint; In the engineering implementation, parallel event disambiguation is further performed on time edges, nearest neighbor retrieval is used to accelerate similar edges, and network edges are hierarchically screened based on additional features such as protocol and autonomous system number to ensure the consistency, traceability and reusability of evidence in subsequent causal coding and edge-level determination.

[0029] Optionally, step S3 further includes: The joint initial graph is divided into multiple training environments based on the regional and platform identifiers recorded in the joint initial graph; In each training environment, the causal transferable graph encoder performs message passing and representation learning on the nodes and edges of the joint initial graph, generating node representations and edge feature representations of temporal evidence channels, content fingerprint evidence channels, and network fingerprint evidence channels. The edge-level predictor generates edge existence probability and edge strength scores based on the edge feature representations of the three types of evidence channels, and fuses the outputs of the three types of evidence channels to make a comprehensive judgment on the existence of the edge. The empirical risk is jointly minimized across all training environments, and a boundary-invariant risk minimization constraint is imposed to ensure that the comprehensive decision remains stable across different training environments and is consistent through shared parameters. The pre-trained backbone parameters and side-level predictors are obtained through iterative optimization.

[0030] The geographic identifier is a field or code indicating the geographical region to which the event record belongs, used for environmental segmentation and statistical aggregation. The platform identifier is a field or code indicating the system or platform type that generated the log, used for environmental segmentation and statistical aggregation. The training environment is a sub-data domain or sub-graph obtained by partitioning the data corresponding to the joint initial graph according to the geographic identifier and platform identifier, used for risk minimization and invariance constraint training in multiple environments. The causal transferable graph encoder is a graph neural network structure that performs message passing on nodes and edges in the joint initial graph and outputs node representations and evidence channel edge feature representations. Its design goals include causal robustness and transferability across environments. The message passing is along the connection relationships in the graph. The process involves aggregating and updating neighborhood information to generate new node or edge representations. The node representation is a low-dimensional vectorized representation of nodes in the graph generated by the causal transferable graph encoder, used for downstream edge-level judgment and path inference. The edge feature representation is a feature vector extracted or constructed by the causal transferable graph encoder for the edge to be evaluated, serving as input to the edge-level predictor. The evidence channel is a parallel feature path composed of different evidence sources for the same candidate edge, used to support multi-source evidence fusion and robust judgment. The temporal sequence evidence channel is an edge feature path constructed based on a unified timestamp and event sequence relationship, including features such as time difference and sequence indication used to characterize causal clues. The content fingerprint evidence channel is based on content fingerprints and their similarity. The constructed edge feature paths are used to reflect content-level similarity and propagation clues; the network fingerprint evidence channels are edge feature paths constructed based on network addresses, service domain names, and their co-occurrence / access associations, used to reflect network-level association evidence; the edge-level predictor is a model module that takes edge feature representations and the outputs of each evidence channel as input, generates edge existence probability and edge strength scores, and outputs a comprehensive judgment result; the edge existence probability is the probabilistic output of the edge-level predictor on whether a candidate edge is valid, used to determine whether an edge exists; the edge strength score is the quantitative score of the edge-level predictor on the strength of the propagation relationship of the candidate edge, used for subsequent path scoring and filtering; the comprehensive judgment is the edge existence judgment value obtained from the outputs of each evidence channel according to a preset fusion strategy, used... The method involves imposing invariance constraints across multiple environments; the empirical risk is an empirical approximation of the expected loss calculated based on labeled samples for edge existence determination and edge strength score in a given training environment; the edge-level invariant risk minimization constraint is an invariance regularization applied to the comprehensive edge existence determination across multiple training environments, so that the optimal determination in different environments is achieved by shared parameters and is insensitive to environmental differences; the shared parameters are the parameter set of the causal transferable graph encoder and edge-level predictor used to generate consistent determinations across training environments; the pre-trained backbone parameters are the shared parameters of the causal transferable graph encoder backbone network obtained after training in multiple environments and satisfying the edge-level invariant risk minimization constraint, excluding the lightweight adapter parameters introduced by subsequent target domain fine-tuning.

[0031] In a specific embodiment, step S3 further includes: In the joint initial diagram The causal transferable graph encoder and the edge predictor are trained on the above, where Represents the overall initial graph. Represents a set of nodes. Represents the set of edges; First, based on the regional identifier and platform identifier, Divided into training environment sets: ; in Represents a set of environment subgraphs. Indicates the first An environmental subgraph, Indicates the quantity of the environment; The encoder performs message passing and reading out of the three types of evidence channels for candidate edges on each environment subgraph to construct edge-level features, represented as follows: ; in Indicate candidate edges In the passage eigenvectors on, Indicates by parameters Controlled channels The encoding function, Let represent the nodes at both ends of the candidate edge, This represents the current environment subgraph. These represent channels indicating the order of time. Content fingerprint channel With network fingerprint channel ; The edge-level predictor then scores the three-channel features in parallel and fuses them to obtain the edge existence probability and edge strength score, represented as: ; in Indicate candidate edges The overall probability of existence, Indicate candidate edges Intensity rating This represents the Sigmoid function. Indicates channel The edge-level prediction sub-model, This represents the parameters of the sub-model. This indicates the existence of channel weights with probabilistic fusion. This represents the channel weights used in the intensity score fusion. To simultaneously minimize empirical risk across multiple environments and impose boundary-invariant risk minimization constraints, the objective function is: ; in This indicates the overall optimization goal. Indicates the environment training batch Expectations Indicates environment The training edge batch set in the middle, This represents the binary cross-entropy loss used for edge existence determination. Indicate candidate edges The existence label, This represents the mean squared error loss used for intensity regression. Indicate candidate edges The strength label, The weighting coefficients representing the intensity loss. The weighting coefficients represent the invariance constraints. Indicates environment The marginal risk above, Indicates the fusion weights gradient operator, This represents a weight vector indicating the existence of probability fusion. This represents the L2 norm; it is used to constrain the stability and consistency of the optimal fusion solution under different environments. In the training implementation, it is jointly optimized through mini-batch stochastic gradient descent. It also monitors consistency indicators across different environments to avoid overfitting and environment-specific correlations, including time-sequential channels. Content fingerprint channel Utilizing fingerprint and similarity features, network fingerprint channels By utilizing co-occurrence and protocol features, pre-trained backbone parameters and edge predictors that satisfy the edge-level invariance constraint are finally obtained for subsequent few-sample fine-tuning of the target region.

[0032] Optionally, step S4 further includes: Extract the target region sub-map from the joint initial map based on the region identifier; Lightweight adapters are attached to the input layer, message passing layer, and readout layer of the causal transferable graph encoder to form a finely adjustable structure; Supervised optimization of pre-trained backbone parameters, edge predictor parameters, and lightweight adapter parameters is performed using labeled samples in the target region subgraph, minimizing the empirical risk of edge predictor in edge existence determination and edge strength scoring in the target region subgraph. After optimization, a causal encoder for the target region is generated, and the causal encoder and the target region subgraph are output.

[0033] The region identifier is a field or code used to indicate the geographical region to which an event or node belongs, and is used to filter data related to the target region from the joint initial graph; the target region subgraph is a subgraph obtained from the joint initial graph based on the region identifier, consisting of nodes whose region identifiers belong to the target region and the edges between them; the input layer is the layer in the causal transferable graph encoder that receives raw or preprocessed features and maps them to hidden representations; the message passing layer is the layer in the causal transferable graph encoder that performs neighborhood information aggregation and representation updates; the readout layer is the layer in the causal transferable graph encoder that aggregates node or edge representations into task outputs or edge-level features; the lightweight adapter is a parameter-limited adaptation module attached to the input layer, message passing layer, and readout layer, used to achieve rapid adaptation of the target region without significantly modifying the pre-trained backbone; the fine-tunable... The structure is a network structure formed by combining a pre-trained backbone and a lightweight adapter, which can be updated via gradient descent. The few labeled samples are a set of samples with edge presence / edge strength labels on the target region subgraph that are significantly smaller than the source domain training data. The edge-level predictor parameters are a set of learnable parameters used in the edge-level predictor to calculate the edge presence probability and edge strength score. The lightweight adapter parameters are a set of learnable parameters in the lightweight adapter module. The supervised optimization is a process of using a few labeled samples to perform labeled training on the relevant parameters of the pre-trained backbone, edge-level predictor, and lightweight adapter with the goal of minimizing the loss function. The target region causal encoder is a causal transferable graph encoder instance for the target region subgraph after fine-tuning with a few samples, including the pre-trained backbone parameters, the updated lightweight adapter parameters, and the edge-level predictor parameters.

[0034] In a specific embodiment, step S4 further includes: Subgraphs of the target region are obtained from the joint initial graph based on the region identifier. Lightweight adapters are then attached to the input, message-passing, and readout layers of the causal transferable graph encoder to form a fine-tunable structure. Supervised fine-tuning is then performed using a small number of labeled samples from the target domain while maintaining the stability of the backbone to reduce empirical risks and avoid catastrophic forgetting. The subgraph extraction can be represented as follows: ; in Represents the target region subgraph, Select Operators that filter subgraphs by region identifier Indicates the joint initial graph, A region identifier representing the target area; In the edge-level representation of the target domain, the backbone readout function and the adapter output are lightly fused: ; in Indicate candidate edges Fusion characteristics Indicates the main parameters Controlled readout function Indicates the main parameters The encoder under control Node representation on express The initial characteristic matrix of the upper node, Indicates the endpoint node index of the candidate edge. Indicates the adapter parameters Equivalent mapping of the lightweight adapter for control; The edge existence probability and edge strength score are given by the classification head and regression head, and are expressed as follows: ; in Indicate candidate edges probability of existence Indicate candidate edges Intensity rating Represents the Sigmoid function, Indicates by parameters Controlled classification head, Indicates by parameters The control regression head; Few-sample fine-tuning is optimized with a joint objective, denoted as: ; in Indicates the target domain optimization objective, This indicates that the training samples are in a mini-batch in the target domain. Expectations Represents a labeled mini-set of candidate edges. This represents the binary cross-entropy loss used for edge existence determination. Representing an edge Existence tags Weighting coefficients representing intensity loss This represents the mean squared error loss used for intensity regression. Representing an edge Strength label The regularity coefficient representing the preservation of the main trunk. This indicates the pre-trained backbone parameters obtained in step S3. Regularity coefficients representing adapter complexity Represents the L2 norm; After training converges, the target domain parameter set is obtained. Used for subsequent candidate edge evaluation and path decoding, where This represents the parameter set of the target region causal encoder and the edge predictor. This represents the backbone parameters after fine-tuning with a small number of samples. Indicates the optimal parameters of the lightweight adapter. This represents the optimal parameters for the classification / regression head.

[0035] Optionally, step S5 further includes: In the target region sub-map, an anchor point set is extracted based on content fingerprint, content distribution network domain name, account identifier, and network address features; The anchor set is used as an instrumental variable to perform two-stage causal estimation. In the first stage, the propagation tendency variable is estimated based on the association between the anchor and the event. In the second stage, the propagation tendency variable and the evidence channel output are jointly calculated in the edge-level predictor to obtain the edge strength score, and a candidate edge set is generated based on the edge strength score and the time sequence constraint. Output the set of candidate edges and the edge strength score.

[0036] The anchor point set is a set of nodes or features selected in the target region subgraph based on content fingerprints, content distribution network domain names, account identifiers, and network address features, used as instrumental variables in the two-stage causal estimation. The instrumental variables are variables related to the formation of candidate propagation edges, providing exogenous changes and directly affecting the propagation outcome without unobserved confounding, used to identify and calibrate propagation causal effects. The two-stage causal estimation is a two-step estimation process driven by instrumental variables. In the first stage, a propagation tendency variable is learned based on the association between anchor points and events. In the second stage, the propagation tendency variable and the evidence channel output are combined in the edge-level predictor to calculate the edge strength score. The propagation tendency variable is estimated by the first-stage model based on the association between instrumental variables and events, used to characterize the information propagation path. The quantitative representation of the propagation probability of candidate edges can be a probability, a score, or a vector; the content delivery network domain name is a network service domain name used for content acceleration, caching, or distribution, including the FQDN of a content delivery network (CDN) node or its subdomains; the network address features are a set of attributes derived from the network address for association and classification, including but not limited to IP prefix / subnet, Autonomous System Number (ASN), geographical location, port / protocol, and resolution or connection behavior statistics; the temporal sequence constraint is a constraint that only allows forward-to-back edge connections based on a unified timestamp and prohibits time jumps or the formation of loops; the candidate edge set is a subset of edges that are retained for further evaluation after the edge strength score is calculated in the edge-level predictor by combining the propagation tendency variable and the evidence channel output and the temporal sequence constraint is satisfied.

[0037] In a specific embodiment, step S5 further includes: Within the target region subgraph, a set of anchor points is selected as instrumental variables, and a two-stage causal estimation is performed. Subsequently, the propagation tendency is combined with three types of evidence channels for edge-level scoring, generating a candidate edge set under time constraints. In the first stage, the instrumental variables are obtained by aggregating the associations of anchor point pairs with directed node pairs, and the propagation tendency is output. ; in Represents directed node pairs The propagation tendency variable These represent the indices of the start and end nodes, respectively. Describes the first-stage estimation function and Its parameters, Indicates the relationship between the anchor point and The aggregation amount of correlation, This represents a commutative aggregation operator (such as a weighted sum or mean). Represents a single anchor instance. Represents the set of anchor points. Indicates anchor point The strength of the correlation between them; The second stage incorporates the tendency to spread into the three types of evidence channels to obtain a marginal strength score: ; in Representing an edge Intensity rating For channel index and Indicates the sequence of time channels, Indicates content fingerprint channel, Indicates the network fingerprint channel. Indicates channel non-negative fusion weights Indicates channel The boundary scoring function and Its parameters, Indicates channel The following is extracted by the encoder Edge-level features; Candidate edges are filtered based on time and intensity thresholds: ; in Denotes the set of candidate edges. Represents the set of directed node pairs that are reachable in time. Representing nodes respectively With nodes A unified timestamp for the corresponding event. Indicates time difference, Indicates the time window threshold. Indicates the intensity threshold; Final output With the corresponding Used for subsequent stability assessment and path decoding.

[0038] Optionally, step S6 further includes: For the candidate edge set, a two-way parallel evaluation is constructed on the target region subgraph: a reality prediction network and an intervention prediction network. Both evaluations are based on the parameters of the target region causal encoder. The reality prediction network predicts feasible paths containing candidate edges and obtains path credibility without intervention. The path credibility is a path-level score obtained by aggregating edge strength scores and time sequence constraints. The intervention prediction network intervenes on candidate edges or their evidence channels along the same path and obtains the confidence of the path after intervention. The intervention includes at least edge deletion, evidence channel masking, or evidence channel weight reset to zero. The evidence channels include time sequence evidence channels, content fingerprint evidence channels, and network fingerprint evidence channels. The stability index is calculated based on the normalized difference ratio between the path credibility of the actual prediction and the intervention prediction. Candidate edges with a stability index below the threshold are then removed, generating a set of credible edges and a set of stability indices.

[0039] The real-world prediction network is an evaluation branch that scores and infers feasible paths containing candidate edges based on a target region causal encoder without applying any intervention to candidate edges or their evidence channels. The intervention prediction network is an evaluation branch that scores and infers candidate edges or their evidence channels after applying a preset intervention under the same path and model parameters as the real-world prediction network. The two-way parallel evaluation is an evaluation process in which the same input is processed by the real-world prediction network and the intervention prediction network to calculate the credibility of the corresponding paths. The feasible path is a node-free sequence formed by connecting candidate edges, satisfying time sequence constraints and conforming to graph connectivity. The path credibility is a path-level score calculated by a preset aggregation function under time sequence constraints based on the edge strength scores of each edge on the feasible path. The intervention is an exogenous operation performed on edges or evidence channels to evaluate the impact of candidate edges on path credibility. The edge deletion is an intervention operation that removes candidate edges from feasible paths and their adjacency relationships during evaluation. Evidence channel masking refers to the intervention operation of emptying, noisying, or blocking the propagation of the characteristic input of a specified evidence channel during evaluation to eliminate its contribution to the decision; the evidence channel weight reset to zero refers to the intervention operation of setting the fusion weight of a specified evidence channel to zero during the fusion stage to suppress its influence on the edge-level or path-level output; the normalized difference ratio is a ratio measure obtained by normalizing the difference in path credibility between the output of the actual prediction network and the intervention prediction network; the stability index is an indicator obtained from the normalized difference ratio and used to quantify the strength of the influence of candidate edges on path credibility; the threshold of the stability index is a preset or adaptive threshold used to determine whether to retain candidate edges; the pseudo edge is a candidate edge that fails to provide sufficient causal support or has insufficient influence on path credibility under intervention and therefore should not be considered as a propagation relationship; the set of credible edges is the set of candidate edges retained under the threshold condition of the stability index; the set of stability indices is the set of stability index values ​​that correspond one-to-one with candidate edges or credible edges.

[0040] In a specific embodiment, step S6 further includes: On the target region subgraph, a two-way parallel evaluation of the candidate edge set obtained in step S5 is performed: a realistic prediction and an intervention prediction. This is done to measure the stability of the edges and filter out false edges. First, for each candidate edge... Limited set of feasible paths: ; in Indicates the presence of candidate edges And a set of acyclic paths that satisfy the time sequence constraint. Indicates a single path. This represents the directed edges in the path. Representing nodes respectively With nodes A unified timestamp for the corresponding event; Path prediction in real-world predictive networks The credibility is expressed as the product of edge strengths: ; in Representing a path Credibility, Representing an edge Intensity rating; In the intervention prediction network, intervention actions are applied at candidate edges on the same path. Credibility after intervention: ; in Indicates path Applying intervention credibility afterward Represents a set of intervention types. Indicates intervention Edge after action Strength and when hour ,when Intensity rescoring was performed according to intervention type; Quantize candidate edges The causal effect is defined by the normalized variance ratio: ; in Indicates in path Top Applying intervention The resulting relative decrease It is the numerical stability constant; Furthermore, for all those containing The stability index is obtained by aggregating feasible paths and intervention types: ; in Representing an edge The stability index, Mean[.] represents the arithmetic mean operator; Finally, the set of reliable edges is filtered according to a threshold: ; in This represents the set of trusted edges that are retained. Denotes the set of candidate edges. The screening threshold representing the stability index; The two networks share the same target region causal encoder parameters to ensure the comparability of the actual prediction and the intervention prediction, and the intervention type can include edge deletion, evidence channel masking, or channel weight reset to zero, etc., which are engineered implementations.

[0041] Optionally, step S7 further includes: On the target region subgraph, the reachable subgraph is constrained based on the set of credible edges, and a time non-backflow constraint is applied to the candidate paths in the reachable subgraph, so that the unified timestamps corresponding to each node in the path are monotonically non-decreasing and do not form cycles. The path-level score is obtained by weighting and aggregating the edge strength scores and corresponding stability indices of each edge on the candidate path. Based on the path-level score, a threshold is set or sorting is performed to truncate the path. Candidate paths that do not meet the threshold or sorting truncation conditions are deleted, and a set of leakage propagation paths consisting of node sequences and trusted edges between them is generated.

[0042] The non-backlash constraint is a constraint that requires the unified timestamps of each node in the path to monotonically remain constant in the access order and not form time bounces or cycles during path construction. Path decoding involves generating paths that meet the conditions under the non-backlash constraint in the target region subgraph using a set of trustworthy edges as the search space, calculating their scores, and outputting a result set. The reachable subgraph is a subgraph obtained by limiting the target region subgraph based on the set of trustworthy edges, containing trustworthy edges and their endpoint nodes, serving as the search space for path decoding. Candidate paths are a sequence of nodes without loops in the reachable subgraph, connected by trustworthy edges and satisfying the non-backlash constraint, to be scored and screened to determine whether to include them in the final result. The weighted aggregation is an operation that combines the edge strength score and corresponding stability index of each edge on the candidate path according to a preset weight or fusion function to obtain a single path-level score. The path-level score is determined by evaluating the candidate paths... The path's credibility is measured by a weighted aggregation of edge strength scores and stability indices. The threshold is a filtering limit set for path-level scores, used to eliminate candidate paths with path-level scores below the threshold. The sorting truncation is a filtering method that retains only candidate paths whose ranking is within a preset number or proportion after sorting candidate paths by path-level scores. The sorting truncation condition is a preset rule used to determine the range of sorting truncation retention, including but not limited to retaining the top K or top P percentages. The node sequence is an ordered set of several graph nodes arranged in access order, with adjacent nodes connected by reliable edges. The reliable edges are the edges retained in step S6 based on the threshold of the stability index and used to form paths. The leakage propagation path set is the final output path set composed of node sequences and reliable edges between them, satisfying the time non-backtracking constraint, after being filtered by the threshold or sorting truncation.

[0043] In a specific embodiment, step S7 further includes: Using the set of trustworthy edges as the search space, path decoding is performed on the target region subgraph, and the set of leakage propagation paths is output. First, the reachable subgraph is limited to constrain the search range and ensure the execution of the time non-backtracking constraint, represented as: ; in Represents reachable subgraphs, This represents an operator that restricts the original graph to a subgraph based on the set of edges. Represents the target region sub-map, Represents the set of trustworthy edges, Indicates by A set of nodes composed of endpoints Describe the set of edges in the reachable subgraph and connect them to the edge set. Consistent; Subsequently The candidate path set is constructed and a time non-backflow constraint is applied, which is expressed as: ; in Represents the set of acyclic candidate paths that are time-monotonic and connected by reliable edges. Indicates a single candidate path, Indicates the first in the path Each node Indicates the number of path nodes, This indicates that adjacent nodes are connected by a trusted edge. Represents a node A unified timestamp for the corresponding event, requiring no backtracking. Indicates the position index in the path; Each candidate path is weighted and aggregated using edge strength and stability indices to obtain a path-level score: ; in Representing a path Path-level rating Representing a path The number of sides in Representing a path One edge on Representing an edge Intensity rating Representing an edge Stability index Represents the non-negative fusion weights of the two items and can be set. Achieve normalization; Finally, the set of leakage propagation paths is obtained by filtering according to the threshold, and is represented as follows: ; in This represents the set of leak propagation paths that are preserved. This represents the filtering threshold for path-level scoring, which can also be used in engineering implementations. Before sorting and truncating, keep the previous steps. Article or preceding To adapt to different visualization and auditing needs.

[0044] The beneficial effects of this invention are as follows: Compared with the prior art, this invention provides a cross-regional data leakage tracking method and system based on transfer learning. Addressing the technical problem of leakage propagation identification in cross-platform, multi-source, and heterogeneous logs, it proposes a closed-loop algorithm combination consisting of data unification, heterogeneous graph modeling, causal coding, target domain few-sample fine-tuning, instrumental variable two-stage estimation, dual-path intervention stability assessment, and path decoding. Each component works synergistically. By fusing edge-level evidence of temporal sequence, content fingerprint, and network fingerprint, the confidence of candidate edges is significantly improved. Through multi-environment invariant risk constraints and target domain adapter fine-tuning, platform-specific pseudo-correlation is suppressed, and efficient transfer is achieved with low annotation levels. Exogenous variations are introduced through instrumental variables, and unobserved confounding is corrected through two-stage estimation. A stability index is generated by combining real-world prediction and intervention prediction to filter out fragile edges. Thus, under time non-rebound and window constraints, a causally consistent, highly reliable, and traceable propagation path is decoded. The overall technical effect is reflected in the simultaneous improvement of accuracy, stability, transferability, and engineering feasibility, while significantly reducing the cost of manual auditing and feature engineering. In terms of algorithm structure, a heterogeneous multi-relation graph carries three types of independent evidence, replacing the fragile structure of single evidence or single similarity; the cross-domain stability of the edge-level representation is enhanced by minimizing multi-environment invariant risk, and a lightweight adapter is used to achieve incremental learning of the target domain with small parameters and low overhead, avoiding catastrophic forgetting; two-stage causal estimation is carried out using the anchor set as an instrumental variable, and the propagation tendency is explicitly incorporated into the edge-level scoring to correct for confounding; a stability index is constructed using dual-path reality / intervention evaluation to provide an interpretable and auditable measure of causal robustness; the candidate space is constrained by time non-backflow and hierarchical threshold, and supplemented by efficient implementation of nearest neighbor retrieval and co-occurrence statistics, comprehensively achieving reliable screening of path-level results and a significant reduction in search complexity. The above structural improvements and implementation strategies work together to further enhance the ability of the algorithm combination of this invention to solve the target technical problem and the reproducibility of the technical effect.

[0045] This invention can be a system, method, and / or computer program product. This invention also discloses a transfer learning-based cross-regional data breach tracing system based on the aforementioned transfer learning-based cross-regional data breach tracing method, comprising: The joint normalization module is used to unify the format encoding and time zone normalization of the raw event logs of the source and target regions, and form a joint normalized event sequence according to the unified timestamp and event field. The graph construction module is used to construct a joint initial graph based on the joint normalized event sequence, with accounts, content, network addresses, and service domain names as nodes, and to establish edges according to the chronological order, content fingerprint similarity, and network fingerprint correlation. The constraint minimization module is used to train a causal transferable graph encoder on a joint initial graph. Based on three types of evidence channels—temporal sequence, content fingerprint, and network fingerprint—it applies invariant risk minimization constraints to the edge predictors in a training environment divided by region and platform, thereby obtaining pre-trained backbone parameters and edge predictors. The lightweight adapter module is used to extract the target region sub-graph according to the region identifier. The lightweight adapter is attached to the input layer, message passing layer and readout layer of the encoder. The pre-trained backbone parameters and side-level predictors are fine-tuned using a small number of labeled samples to obtain the target region causal encoder and the target region sub-graph. The scoring calculation module is used to extract the anchor point set in the target region subgraph, use it as an instrumental variable to perform two-stage causal estimation, obtain the propagation tendency variable, combine the propagation tendency variable with the three types of evidence channels in the edge-level predictor to calculate the edge strength score, and generate a candidate edge set by combining the time sequence constraint. The parallel evaluation module is used to evaluate the candidate edge set in parallel based on the causal encoder of the target region to construct the real prediction network and the intervention prediction network. It calculates the difference ratio of the credibility of the two paths as the stability index, and deletes false edges based on the threshold to obtain the set of credible edges and the set of stability index. The output module is used to decode the set of trusted edges on the target region subgraph based on the time non-backflow constraint, edge strength score and stability index, and generate a set of leakage propagation paths.

[0046] Based on the spirit of this invention, those skilled in the art will readily conceive of a computer program product derived from the aforementioned cross-regional data breach tracing method based on transfer learning. The computer program product may include a computer-readable storage medium on which computer-readable program instructions are loaded to cause a processor to implement various aspects of this disclosure. That is, this application also includes a terminal comprising a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to perform the steps of the aforementioned cross-regional data breach tracing method based on transfer learning.

[0047] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0048] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0049] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0050] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A method for tracking cross-region data leakage based on transfer learning, characterized in that, The method comprises the following steps: S1, format coding and time zone normalization of original event logs of source and target areas, forming joint normalized event sequences according to unified timestamps and event fields; S2, according to the joint normalized event sequence, taking account, content, network address and service domain name as nodes, and according to time sequence, content fingerprint similarity and network fingerprint correlation, edges are established to construct a joint initial graph; S3, training a causal migratory graph encoder on the joint initial graph, based on the three types of evidence channels of time sequence, content fingerprint and network fingerprint, under the training environment divided by region and platform, and under the invariable risk minimization constraint of edge-level predictor, the pre-training backbone parameters and edge-level predictor are obtained; S4, extracting target area subgraph according to region identifier, connecting lightweight adapter to the input layer, message passing layer and readout layer of the encoder, and fine-tuning the pre-training backbone parameters and edge-level predictor with a small amount of labeled samples to obtain the target area causal encoder and target area subgraph; S5, extracting anchor point set in the target area subgraph as instrumental variable to perform two-stage causal estimation to obtain propagation tendency variable, combining the propagation tendency variable with the three types of evidence channels to output the edge strength score in the edge-level predictor, and generating a candidate edge set combining the time sequence constraint; S6, constructing a real-time prediction network and an intervention prediction network in parallel based on the target area causal encoder to evaluate the candidate edge set, calculating the difference ratio of the credibility of the two paths as the stability index, deleting the pseudo edges based on the threshold to obtain the credible edge set and the stability index set; S7, path decoding of the credible edge set according to the time non-back jump constraint, edge strength score and stability index on the target area subgraph to generate a set of leakage propagation paths. 2.The method of claim 1, wherein, The step S1 further comprises: Performing format standardization and coding uniformity on the original event logs of the source and target areas, extracting basic event fields and establishing field standard mapping, so that each event record contains at least a unified timestamp, event type, account identifier, network address, service domain name, content field, region identifier and platform identifier; According to the available time zone information, the timestamp is converted to a unified time reference and sorted according to the unified timestamp to form a time-ordered record sequence, and at the same time, the repeated records are removed, the missing fields are treated with missing values, and the abnormal values are reasonably corrected, thereby generating a joint normalized event sequence. 3.The method of claim 2, wherein, The step S2 further comprises: According to the account identifier, content field, network address and service domain name in the joint normalized event sequence, the same type of records are aggregated to generate node sets of account entities, content entities, network address entities and service domain name entities; According to the unified timestamp of the joint normalized event sequence, a directed edge of the time sequence from the previous to the next is established between different events involving the same content entity; According to the content field, a content fingerprint is generated, and edges of content fingerprint similarity are established between content entities according to similarity judgment; edges between the account entity, the network address entity, the service domain name entity and the content entity are established according to the co-occurrence or access association of the network address and the service domain name in the joint normalized event sequence; the node set, the time sequence relationship, the content fingerprint similarity and the network fingerprint association edge are combined into a joint initial graph. 4.The method of claim 3, wherein, The step S3 further comprises: The joint initial graph is divided into multiple training environments according to the regional identifier and the platform identifier recorded in the joint initial graph; The nodes and edges of the joint initial graph are message-passing and representation learning by the causally migratable graph encoder in each training environment, and the node representation and the edge feature representation of the time sequence evidence channel, the content fingerprint evidence channel and the network fingerprint evidence channel are generated; The edge existence probability and the edge strength score are respectively generated by the edge-level predictor based on the edge feature representation of the three types of evidence channels, and the outputs of the three types of evidence channels are fused to comprehensively determine the existence of the edge; The experience risk is minimized on all training environments and the edge-level invariant risk minimization constraint is applied, so that the comprehensive determination remains stable in different training environments and is realized by shared parameters; The pre-training backbone parameters and the edge-level predictor are obtained by iterative optimization. 5.The method of claim 4, wherein, The step S4 further comprises: The target region subgraph is extracted according to the regional identifier in the joint initial graph; The light adapter is hung on the input layer, the message passing layer and the readout layer of the causally migratable graph encoder to form a fine-tunable structure; The pre-training backbone parameters, the edge-level predictor parameters and the light adapter parameters are supervised optimized by using the labeled samples in the target region subgraph, so that the experience risk of the edge existence determination and the edge strength score of the edge-level predictor on the target region subgraph is minimized; After the optimization is completed, the target region causal encoder is generated, and the target region causal encoder and the target region subgraph are output. 6.The method of claim 5, wherein, The step S5 further comprises: The anchor point set is extracted according to the content fingerprint, the content distribution network domain name, the account identifier and the network address features in the target region subgraph; The two-stage causal estimation is performed by taking the anchor point set as instrumental variables, wherein the first stage estimates the propagation propensity variable according to the association of the anchor point and the event, and the second stage jointly calculates the propagation propensity variable and the evidence channel output in the edge-level predictor to obtain the edge strength score, and generates a candidate edge set according to the edge strength score and the time sequence constraint; The candidate edge set and the edge strength score are output. 7.The method of claim 6, wherein, The step S6 further comprises: The real prediction network and the intervention prediction network are constructed on the target region subgraph for the candidate edge set, and the two parallel evaluations are based on the parameters of the target region causal encoder; The real prediction network predicts the feasible path containing the candidate edge under the condition of no intervention and obtains the path credibility, and the path credibility is the path-level score aggregated according to the edge strength score and the time sequence constraint; The intervention prediction network predicts the path credibility of the candidate edge under the condition of intervention, and the path credibility is the path-level score aggregated according to the edge strength score and the time sequence constraint. The intervention prediction network intervenes on candidate edges or their evidence channels on the same path and obtains the path credibility after intervention, the intervention at least includes edge deletion, evidence channel masking or evidence channel weight zero, the evidence channel includes time sequence evidence channel, content fingerprint evidence channel and network fingerprint evidence channel; A stability index is calculated according to the normalized difference ratio between the path credibility of the reality prediction and the intervention prediction, and candidate edges with a stability index lower than a threshold are deleted according to the threshold, to generate a credible edge set and a stability index set. 8.The method of claim 7, wherein, The step S7 further includes: On the target region subgraph, a reachable subgraph is defined according to the credible edge set, and a time non-back jump constraint is applied to the candidate paths in the reachable subgraph, so that the uniform timestamp corresponding to each node in the path is monotonically non-decreasing and does not form a loop; The path level score is obtained by weighting and aggregating the edge strength score of each edge on the candidate path and the corresponding stability index; According to the path level score, a threshold is set or sorting is truncated, candidate paths that do not meet the threshold or sorting truncation condition are deleted, and a set of leakage propagation paths composed of node sequences and credible edges therebetween is generated. 9.A cross-region data leakage tracking system based on transfer learning, characterized in that, It includes: A joint normalization module is configured to format and unify the original event logs of the source region and the target region, and normalize the time zone, and form a joint normalized event sequence according to the uniform timestamp and the event field; A graph construction module is configured to construct a joint initial graph according to the joint normalized event sequence, taking account, content, network address and service domain name as nodes, and establishing edges according to time sequence, content fingerprint similarity and network fingerprint association; A minimum constraint module is configured to train a causal migratory graph encoder on the joint initial graph, and apply an invariant risk minimization constraint to the edge level predictor in a training environment divided by region and platform based on three types of evidence channels of time sequence, content fingerprint and network fingerprint, to obtain pre-training backbone parameters and edge level predictor; A lightweight adaptation module is configured to extract a target region subgraph according to the region identifier, and connect a lightweight adapter to the input layer, message passing layer and readout layer of the encoder, and fine-tune the pre-training backbone parameters and edge level predictor using a small amount of labeled samples to obtain a target region causal encoder and a target region subgraph; A score calculation module is configured to extract an anchor point set in the target region subgraph, execute two-stage causal estimation as instrumental variables, obtain a propagation tendency variable, and calculate an edge strength score in the edge level predictor combined with the three types of evidence channels and the propagation tendency variable, and generate a candidate edge set combined with the time sequence constraint; A parallel evaluation module is configured to construct a reality prediction network and an intervention prediction network in parallel based on the target region causal encoder for the candidate edge set, calculate the difference ratio of the two-way path credibility as a stability index, delete false edges based on a threshold, and obtain a credible edge set and a stability index set; An output module is configured to perform path decoding on the credible edge set on the target region subgraph according to the time non-back jump constraint, the edge strength score and the stability index, and generate a set of leakage propagation paths.

10. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is configured to store instructions; The processor is configured to operate according to the instructions to perform the steps of the method for tracking cross-region data leakage based on transfer learning according to any one of claims 1-8.

Images